Re: [xml] Release of libxml2 2.9.11

[Jan Tojnar <jtojnar gmail com>]

Hi, trying to build the package from the tarball on NixOS, it appears 
that fuzz/fuzz.h is missing from the archive:

testFuzzer.c:13:10: fatal error: fuzz.h: No such file or directory
  13 | #include "fuzz.h"
     |          ^~~~~~~~
compilation terminated.

It appears to be available in the git repo, so perhaps it just needs to 
be added to EXTRA_DIST or something?

On Thu, May 13 2021 at 15:54:55 +0200, Daniel Veillard via xml 
<xml gnome org> wrote:
>   Pffff, I am way way behind, but now that CVE-2021-3541 is out I 
> just pushed
> that long awaited release. libxml2 2.9.11 is tagged in git and a 
> signed
> tarball is available at the usual place:
>
>     ftp://xmlsoft.org/libxml2/
>
>
>   This release incoporate the various security and quadatic patches 
> that
> Nick has found and fixed, and CVE-2021-3541. There is also a very 
> large list
> of bug fixes and improvement most of them from Nick too:
>
> Security:
> - Patch for security issue CVE-2021-3541 (Daniel Veillard)
> Documentation:
> - Clarify xmlNewDocProp documentation (Nick Wellnhofer)
> Portability:
> - CMake: Only add postfixes if MSVC (Christopher Degawa)
> - Fix XPath NaN/Inf for older GCC versions (Nick Wellnhofer)
> - Use CMake PROJECT_VERSION (Markus Rickert)
> - Fix warnings in libxml.m4 with autoconf 2.70+. (Simon Josefsson)
> - Add CI for CMake on MSVC (Markus Rickert)
> - Update minimum required CMake version (Markus Rickert)
> - Add variables for configured options to CMake config files (Markus 
> Rickert)
> - Check if variables exist when defining targets (Markus Rickert)
> - Check if target exists when reading target properties (Markus 
> Rickert)
> - Add xmlcatalog target and definition to config files (Markus 
> Rickert)
> - Remove include directories for link-only dependencies (Markus 
> Rickert)
> - Fix ICU build in CMake (Markus Rickert)
> - Configure pkgconfig, xml2-config, and xml2Conf.sh file (Markus 
> Rickert)
> - Update CMake config files (Markus Rickert)
> - Add xmlcatalog and xmllint to CMake export (Markus Rickert)
> - Simplify xmlexports.h (Nick Wellnhofer)
> - Require dependencies based on enabled CMake options (Markus Rickert)
> - Use NAMELINK_COMPONENT in CMake install (Markus Rickert)
> - Add CMake files to EXTRA_DIST (Markus Rickert)
> - Add missing compile definition for static builds to CMake (Markus 
> Rickert)
> - Add CI for CMake on Linux and MinGW (Markus Rickert)
> - Fix variable name in win32/configure.js (Nick Wellnhofer)
> - Fix version parsing in win32/configure.js (Nick Wellnhofer)
> - Fix autotools warnings (Nick Wellnhofer)
> - Update config.h.cmake.in (Markus Rickert)
> - win32: allow passing *FLAGS on command line (Michael Stahl)
> - Configure file xmlwin32version.h.in on MSVC (Markus Rickert)
> - List headers individually (Markus Rickert)
> - Add CMake build files (Markus Rickert)
> - Parenthesize Py<type>_Check() in ifs (Miro Hrončok)
> - Minor fixes to configure.js (Nick Wellnhofer)
> Bug Fixes:
> - Fix null deref in legacy SAX1 parser (Nick Wellnhofer)
> - Fix handling of unexpected EOF in xmlParseContent (Nick Wellnhofer)
> - Fix line numbers in error messages for mismatched tags (Nick 
> Wellnhofer)
> - Fix htmlTagLookup (Nick Wellnhofer)
> - Propagate error in xmlParseElementChildrenContentDeclPriv (Nick 
> Wellnhofer)
> - Fix user-after-free with `xmllint --xinclude --dropdtd` (Nick 
> Wellnhofer)
> - Fix dangling pointer with `xmllint --dropdtd` (Nick Wellnhofer)
> - Validate UTF8 in xmlEncodeEntities (Joel Hockey)
> - Fix use-after-free with `xmllint --html --push` (Nick Wellnhofer)
> - Allow FP division by zero in xmlXPathInit (Nick Wellnhofer)
> - Fix xmlGetNodePath with invalid node types (Nick Wellnhofer)
> - Fix exponential behavior with recursive entities (Nick Wellnhofer)
> - Fix quadratic behavior when looking up xml:* attributes (Nick 
> Wellnhofer)
> - Fix slow parsing of HTML with encoding errors (Nick Wellnhofer)
> - Fix null deref introduced with previous commit (Nick Wellnhofer)
> - Check for invalid redeclarations of predefined entities (Nick 
> Wellnhofer)
> - Add the copy of type from original xmlDoc in xmlCopyDoc() 
> (SVGAnimate)
> - parser.c: shrink the input buffer when appropriate (Mike Dalessio)
> - Fix infinite loop in HTML parser introduced with recent commits 
> (Nick Wellnhofer)
> - Fix quadratic runtime when parsing CDATA sections (Nick Wellnhofer)
> - Fix timeout when handling recursive entities (Nick Wellnhofer)
> - Fix memory leak in xmlParseElementMixedContentDecl (Nick Wellnhofer)
> - Fix null deref in xmlStringGetNodeList (Nick Wellnhofer)
> - use new htmlParseLookupCommentEnd to find comment ends (Mike 
> Dalessio)
> - htmlParseComment: treat `--!>` as if it closed the comment (Mike 
> Dalessio)
> - Fix integer overflow in xmlSchemaGetParticleTotalRangeMin (Nick 
> Wellnhofer)
> - encoding: fix memleak in xmlRegisterCharEncodingHandler() (Xiaoming 
> Ni)
> - xmlschemastypes.c: xmlSchemaGetFacetValueAsULong add, check 
> "facet->val" (Xiaoming Ni)
> - Fix null pointer deref in xmlXPtrRangeInsideFunction (Nick 
> Wellnhofer)
> - Fix quadratic runtime in HTML push parser with null bytes (Nick 
> Wellnhofer)
> - Avoid quadratic checking of identity-constraints (Michael Matz)
> - Fix building with ICU 68. (Frederik Seiffert)
> - Convert python/libxml.c to PY_SSIZE_T_CLEAN (Victor Stinner)
> - Fix xmlURIEscape memory leaks. (Elliott Hughes)
> - Avoid call stack overflow with XML reader and recursive XIncludes 
> (Nick Wellnhofer)
> - Fix caret in regexp character group (Nick Wellnhofer)
> - parser.c: xmlParseCharData peek behavior fixed wrt newlines (Mike 
> Dalessio)
> - Fix memory leaks in XPointer string-range function (Nick Wellnhofer)
> - Fix use-after-free when XIncluding text from Reader (Nick 
> Wellnhofer)
> - Fix SEGV in xmlSAXParseFileWithData (yanjinjq)
> - Fix null deref in XPointer expression error path (Nick Wellnhofer)
> - Don't call xmlXPathInit directly (Nick Wellnhofer)
> - Fix cleanup of attributes in XML reader (Nick Wellnhofer)
> - Fix double free in XML reader with XIncludes (Nick Wellnhofer)
> - Fix memory leak in xmlXIncludeAddNode error paths (Nick Wellnhofer)
> - Revert "Fix quadratic runtime in xi:fallback processing" (Nick 
> Wellnhofer)
> - Fix error reporting with xi:fallback (Nick Wellnhofer)
> - Fix quadratic runtime in xi:fallback processing (Nick Wellnhofer)
> - Fix corner case with empty xi:fallback (Nick Wellnhofer)
> - Fix XInclude regression introduced with recent commit (Nick 
> Wellnhofer)
> - Fix memory leak in runtest.c (Nick Wellnhofer)
> - Make "xmllint --push --recovery" work (Nick Wellnhofer)
> - Revert "Do not URI escape in server side includes" (Nick Wellnhofer)
> - Fix column number accounting in xmlParse*NameAndCompare (Nick 
> Wellnhofer)
> - Stop counting nbChars in parser context (Nick Wellnhofer)
> - Fix out-of-bounds read with 'xmllint --htmlout' (Nick Wellnhofer)
> - Fix exponential runtime and memory in xi:fallback processing (Nick 
> Wellnhofer)
> - Don't process siblings of root in xmlXIncludeProcess (Nick 
> Wellnhofer)
> - Don't recurse into xi:include children in xmlXIncludeDoProcess 
> (Nick Wellnhofer)
> - Fix memory leak in xmlXIncludeIncludeNode error paths (Nick 
> Wellnhofer)
> - Check for custom free function in global destructor (Nick 
> Wellnhofer)
> - Fix integer overflow when comparing schema dates (Nick Wellnhofer)
> - Fix exponential runtime in xmlFARecurseDeterminism (Nick Wellnhofer)
> - Don't try to handle namespaces when building HTML documents (Nick 
> Wellnhofer)
> - Fix several quadratic runtime issues in HTML push parser (Nick 
> Wellnhofer)
> - Fix quadratic runtime when push parsing HTML start tags (Nick 
> Wellnhofer)
> - Reset XML parser input before reporting errors (David Kilzer)
> - Fix quadratic runtime when push parsing HTML entity refs (Nick 
> Wellnhofer)
> - Fix HTML push parser lookahead (Nick Wellnhofer)
> - Make htmlCurrentChar always translate U+0000 (Nick Wellnhofer)
> - Fix UTF-8 decoder in HTML parser (Nick Wellnhofer)
> - Fix quadratic runtime when parsing HTML script content (Nick 
> Wellnhofer)
> - Reset HTML parser input before reporting error (Nick Wellnhofer)
> - Fix more quadratic runtime issues in HTML push parser (Nick 
> Wellnhofer)
> - Fix regression introduced with 477c7f6a (Nick Wellnhofer)
> - Fix quadratic runtime in HTML parser (Nick Wellnhofer)
> - Reset HTML parser input before reporting encoding error (Nick 
> Wellnhofer)
> - Fix integer overflow in xmlFAParseQuantExact (Nick Wellnhofer)
> - Fix return value of xmlC14NDocDumpMemory (Nick Wellnhofer)
> - Don't follow next pointer on documents in xmlXPathRunStreamEval 
> (Nick Wellnhofer)
> - Fix integer overflow in _xmlSchemaParseGYear (Nick Wellnhofer)
> - Fix integer overflow when parsing {min,max}Occurs (Nick Wellnhofer)
> - Fix another memory leak in xmlSchemaValAtomicType (Nick Wellnhofer)
> - Fix unsigned integer overflow in htmlParseTryOrFinish (Nick 
> Wellnhofer)
> - Fix integer overflow in htmlParseCharRef (Nick Wellnhofer)
> - Fix undefined behavior in UTF16LEToUTF8 (Nick Wellnhofer)
> - Fix return value of xmlCharEncOutput (Nick Wellnhofer)
> - Never expand parameter entities in text declaration (Nick 
> Wellnhofer)
> - Fix undefined behavior in xmlXPathTryStreamCompile (Nick Wellnhofer)
> - Fix use-after-free with validating reader (Nick Wellnhofer)
> - xmlParseBalancedChunkMemory must not be called with NULL doc (Nick 
> Wellnhofer)
> - Revert "Fix memory leak in xmlParseBalancedChunkMemoryRecover" 
> (Nick Wellnhofer)
> - Fix memory leak in xmlXIncludeLoadDoc error path (Nick Wellnhofer)
> - Make schema validation fail with multiple top-level elements (Nick 
> Wellnhofer)
> - Call xmlCleanupParser on ELF destruction (Samuel Thibault)
> - Fix copying of entities in xmlParseReference (Nick Wellnhofer)
> - Fix memory leak in xmlSchemaValidateStream (Zhipeng Xie)
> - Fix xmlSchemaGetCanonValue formatting for date and dateTime (Kevin 
> Puetz)
> - Fix memory leak when shared libxml.dll is unloaded (Kevin Puetz)
> - Fix potentially-uninitialized critical section in Win32 DLL builds 
> (Kevin Puetz)
> - Fix integer overflow in xmlBufferResize (Nick Wellnhofer)
> - Check for overflow when allocating two-dimensional arrays (Nick 
> Wellnhofer)
> - Remove useless comparisons (Nick Wellnhofer)
> - Fix overflow check in xmlNodeDump (Nick Wellnhofer)
> - Fix infinite loop in xmlStringLenDecodeEntities (Zhipeng Xie)
> - Fix freeing of nested documents (Nick Wellnhofer)
> - Fix more memory leaks in error paths of XPath parser (Nick 
> Wellnhofer)
> - Fix memory leaks of encoding handlers in xmlsave.c (Nick Wellnhofer)
> - Fix xml2-config error code (Nick Wellnhofer)
> - Fix memory leak in error path of XPath expr parser (Nick Wellnhofer)
> - Fix overflow handling in xmlBufBackToBuffer (Nick Wellnhofer)
> - Null pointer handling in catalog.c (raniervf)
> - xml2-config.in: fix regressions introduced by commit 2f2bf4b2c 
> (Dmitry V. Levin)
> Improvements:
> - Store per-element parser state in a struct (Nick Wellnhofer)
> - update for xsd:language type check (PaulHiggs)
> - Update INSTALL.libxml2 (Nick Wellnhofer)
> - Fix include order in c14n.h (Nick Wellnhofer)
> - Fix duplicate xmlStrEqual calls in htmlParseEndTag (Nick Wellnhofer)
> - Speed up htmlCheckAutoClose (Nick Wellnhofer)
> - Speed up htmlTagLookup (Nick Wellnhofer)
> - Stop checking attributes for UTF-8 validity (Nick Wellnhofer)
> - Reduce some fuzzer timeouts (Nick Wellnhofer)
> - Only run a few CI tests unless scheduled (Nick Wellnhofer)
> - Improve fuzzer stability (Nick Wellnhofer)
> - Check for feature flags in fuzzer tests (Nick Wellnhofer)
> - Another attempt at improving fuzzer stability (Nick Wellnhofer)
> - Revert "Improve HTML fuzzer stability" (Nick Wellnhofer)
> - Add charset names to fuzzing dictionaries (Nick Wellnhofer)
> - Improve HTML fuzzer stability (Nick Wellnhofer)
> - Add CI for MSVC x86 (Markus Rickert)
> - Add a flag to not output anything when xmllint succeeded (hhb)
> - Speed up HTML fuzzer (Nick Wellnhofer)
> - Remove unused encoding parameter of HTML output functions (Nick 
> Wellnhofer)
> - Handle malloc failures in fuzzing code (Nick Wellnhofer)
> - add test coverage for incorrectly-closed comments (Mike Dalessio)
> - Enforce maximum length of fuzz input (Nick Wellnhofer)
> - Remove temporary members from struct _xmlXPathContext (Nick 
> Wellnhofer)
> - Build the Python extension with PY_SSIZE_T_CLEAN (Victor Stinner)
> - Add CI test for Python 3 (Nick Wellnhofer)
> - Add fuzzing dictionaries to EXTRA_DIST (Nick Wellnhofer)
> - Add 'fuzz' subdirectory to DIST_SUBDIRS (Nick Wellnhofer)
> - Allow port numbers up to INT_MAX (Nick Wellnhofer)
> - Handle dumps of corrupted documents more gracefully (Nick 
> Wellnhofer)
> - Limit size of free lists in XML reader when fuzzing (Nick 
> Wellnhofer)
> - Hardcode maximum XPath recursion depth (Nick Wellnhofer)
> - Pass URL of main entity in XML fuzzer (Nick Wellnhofer)
> - Consolidate seed corpus generation (Nick Wellnhofer)
> - Test fuzz targets with dummy driver (Nick Wellnhofer)
> - Fix regression introduced with commit d88df4b (Nick Wellnhofer)
> - Fix regression introduced with commit 74dcc10b (Nick Wellnhofer)
> - Add TODO comment in xinclude.c (Nick Wellnhofer)
> - Stop using maxParserDepth in xpath.c (Nick Wellnhofer)
> - Remove dead code in xinclude.c (Nick Wellnhofer)
> - Don't add formatting newlines to XInclude nodes (Nick Wellnhofer)
> - Don't use SAX1 if all element handlers are NULL (Nick Wellnhofer)
> - Remove unneeded progress checks in HTML parser (Nick Wellnhofer)
> - Use strcmp when fuzzing (Nick Wellnhofer)
> - Fix XPath fuzzer (Nick Wellnhofer)
> - Fuzz XInclude engine (Nick Wellnhofer)
> - Add XPath and XPointer fuzzer (Nick Wellnhofer)
> - Update fuzzing code (Nick Wellnhofer)
> - More *NodeDumpOutput fixes (Nick Wellnhofer)
> - Fix *NodeDumpOutput functions (Nick Wellnhofer)
> - Make xmlNodeDumpOutputInternal non-recursive (Nick Wellnhofer)
> - Make xhtmlNodeDumpOutput non-recursive (Nick Wellnhofer)
> - Make htmlNodeDumpFormatOutput non-recursive (Nick Wellnhofer)
> - Fix .gitattributes (Nick Wellnhofer)
> - Rework control flow in htmlCurrentChar (Nick Wellnhofer)
> - Make 'xmllint --html --push -' read from stdin (Nick Wellnhofer)
> - Remove misleading comments in xpath.c (Nick Wellnhofer)
> - Update to Devhelp index file format version 2 (Andre Klapper)
> - Set project language to C (Markus Rickert)
> - Add variable for working directory of XML Conformance Test Suite 
> (Markus Rickert)
> - Add additional tests and XML Conformance Test Suite (Markus Rickert)
> - Add command line option for temp directory in runtest (Markus 
> Rickert)
> - Ensure LF line endings for test files (Markus Rickert)
> - Enable runtests and testThreads (Markus Rickert)
> - Limit regexp nesting depth (Nick Wellnhofer)
> - Fix return values and documentation in encoding.c (Nick Wellnhofer)
> - Add regexp regression tests (David Kilzer)
> - Report error for invalid regexp quantifiers (Nick Wellnhofer)
> - Fix rebuilding docs, by hiding __attribute__((...)) behind a macro. 
> (Martin Vidner)
> - Copy xs:duration parser from libexslt (Nick Wellnhofer)
> - Fuzz target for XML Schemas (Nick Wellnhofer)
> - Move entity recorder to fuzz.c (Nick Wellnhofer)
> - Fuzz target for HTML parser (Nick Wellnhofer)
> - Update GitLab CI container (Nick Wellnhofer)
> - Add options file for xml fuzzer (Nick Wellnhofer)
> - Add a couple of libFuzzer targets (Nick Wellnhofer)
> - Guard new calls to xmlValidatePopElement in xml_reader.c (Daniel 
> Cheng)
> - Add LIBXML_VALID_ENABLED to xmlreader (Łukasz Wojniłowicz)
> - Fix typos (Nick Wellnhofer)
> - Disable LeakSanitizer (Nick Wellnhofer)
> - Stop calling SAX getEntity handler from XMLReader (Nick Wellnhofer)
> - Add test case for recursive external parsed entities (Nick 
> Wellnhofer)
> - Enable error tests with entity substitution (Nick Wellnhofer)
> - Don't load external entity from xmlSAX2GetEntity (Nick Wellnhofer)
> - Merge code paths loading external entities (Nick Wellnhofer)
> - Copy some XMLReader option flags to parser context (Nick Wellnhofer)
> - Add xmlPopOutputCallbacks (Nick Wellnhofer)
> - Updated Python test reader2.py (Pieter van Oostrum)
> - Updated python/tests/tstLastError.py (Pieter van Oostrum)
> - Use random seed in xmlDictComputeFastKey (Ranier Vilela)
> - Enable more undefined behavior sanitizers (Nick Wellnhofer)
>
>   Thanks everybody who contributed for this release, obviously Nick 
> did
> the bulk of the work but there were a number of other contributors,
>
>    enjoy !
>
> Daniel
>
> --
> Daniel Veillard      | Red Hat Developers Tools 
> http://developer.redhat.com/
> veillard redhat com  | libxml Gnome XML XSLT toolkit  
> http://xmlsoft.org/
> http://veillard.com/ | virtualization library  http://libvirt.org/
>
> _______________________________________________
> xml mailing list, project page  http://xmlsoft.org/
> xml gnome org
> https://mail.gnome.org/mailman/listinfo/xml